[FEATURE] Implement isolated compatibility realms and exact grant lifecycles #1
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/posixd#1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
Compatibility programs need process-local filesystem, execution and stream routes without receiving global service authority. They also need bounded exceptional operations and reliable teardown across launch, approval, crash and cancellation.
Proposed behavior and scope
Staged construction without root capabilities — 15 September 2026
Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution.
Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority.
Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint.
The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability.
On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire.
Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone.
Native staged endpoint attenuation — 15 September 2026
Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added.
Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero.
The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects.
Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary.
Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force.
Staged mediator handoff contract — 15 September 2026
Reserve Loaderd operation
0x654(PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class0x448(REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation0x652keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted.Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop.
Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate.
This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance.
Implement realm create/configure/seal/start/abort/retire states, namespace ceilings, deny-only compatibility credentials, resource accounting and ext4-based service startup. Integrate authenticated exceptional grants to exact live processes, including trusted consent and noninteractive build denial.
The updated ownership design is published in WIP PR #5 at signed
4f1a964cd32e0b46ccf73f87a3be2efbb5f128ec. Its focused contract requires guarded SEND-branch custody before export, final-process receiver readiness before releasing the producer's sender, and private configuration pulls with capability-bearing owner replies. Ordinary control and client senders do not gain GRANT.Typed provisioning must consume the actual moved process-bound install grant; staged-process records and the retained SEND-only derived installer do not replace it. Procd is the proposed route-guard owner for mediator/Launchd loss. Procd loss needs a distinct ancestor guard, a surviving native holder and an independent trigger. Product Rootd exits after bootstrap. Quarantine, alias absence, process destruction and operation/provider completion remain separate facts. No upstream holder, wire field or runtime behavior is assigned by this documentation change.
All 10 Markdown files, 19 local links, canonical sections, six governance files, original source correlation and whitespace checks pass for the three-file correction. Both current component push CI 3 and PR CI 4 pass, checking all 10 Markdown files with zero lint errors. Both complete logs total 7,232 bytes and are bound to the signed source. This is documentation validation, with no runtime acceptance. Matching Docs
928ff81a1d6dea09145f49fd4fbe07ab84525000in Docs PR #4 is signed and published. Its nineteen API routes select original seventeen-function library 4207509, and the realm narrative matches the guarded custody design. All 44 documentation tests, selected API consistency and 55 Markdown files pass. The complete 2,331-page manual has zero final warnings and all 423,064 word boxes fit; nine selected pages pass visual review. An initial page-selection bound failure and a finalization-prefix collision remain retained and are corrected without render, extraction, API or runtime replay. Matching Docs push CI 833 and PR CI 834 both pass for signed928ff81a, ending at 04:51:47 UTC on September 13. Each manual job passes 44 tests and produces 2,331 pages with zero final-pass warnings; each Markdown job checks 55 files with zero errors. All four complete logs are retained (750,388 bytes). Thirty first-pass and one second-pass convergence warnings per manual resolve before the final pass. The logged final PDF size is 4,090,720 bytes; CI artifact bytes and geometry were not independently inspected. Prior Docs b11a745 and CI831/832 validate only the preceding fourteen-function manual. Prior source91b18c9199ff8c9219a5e47718d951266722761cpassed CI1/2 and its preceding manual passed Docs CI821/822; those results remain specific to the prior design. The initial prior Markdown failure remains retained.The repository has no implementation crate. Native acceptance must include two actual mediator processes, two clients per realm, real mediated byte I/O, authenticated denial and complete owned retirement. Rust/VM checks are inapplicable to this documentation-only change; no runtime acceptance or completion credit is claimed.
This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.
Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability.
Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph.
This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself.
Authority, security and reliability
Bind capabilities and revocable aliases to process/job/realm generations, resolved objects, permitted operations and finite lifetimes. Numeric realms, uid 0, PATH and labels cannot mint access. Keep native private receive routes internal, and retire all descendants and partial transfers when the realm ends.
Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.
Acceptance criteria
posixd; separateprivate native service routes from each client's narrow authenticated ingress and reject
numeric-realm impersonation.
generation-bound identities, validated resource ceilings and exact rollback.
cwd/root selectors and inherited streams from actual receipts.
supplies only its selected routes, and never grants global
named, provider, device,raw-block or kernel process-control endpoints.
admission; test uid 0, chmod/chown-like metadata and executable permission changes cannot
manufacture access or bypass a capability ceiling.
namespace/executable roots; environment text, absolute paths and
..cannot escape the realmor select an undelegated service.
with deterministic exhaustion and no fixed accidental table cap.
with documented errors, without hanging for a hidden prompt.
timeout and supervisor failure; retire all descendants/aliases and prove process/realm
generation reuse cannot recover prior authority.
service routes and teardown; include malicious message replay.
posixdfrom ext4 after the required native services; keepcompatibility orchestration out of rootd and preserve READY/shell ordering.
processes through their authenticated launch/realm route; resolve only within the caller's
existing delegated selector ceiling.
permitted operation and explicit one-shot/invocation/transaction lifetime. Never turn approval
into a broad directory or reusable admin grant.
provenance, operation, object and lifetime; escape untrusted labels and keep labels/argv/paths
non-authoritative.
renderer acknowledgement and fresh-input fences on serial and framebuffer TTYs. Untrusted PTY
output cannot approve or spoof a prompt.
caller-local slots and tracked revocable aliases; reject stale, replaced, cancelled or
already-exited recipients and clean partial delivery.
including process death during approval and errors after one-shot consumption. No grant
remains reusable by a later process or shell command.
envelopes; require a fresh explicit policy for any traversal scope, and prove
rollback/partial-progress rules without ambient parent-directory write.
process exit, wrong TTY, replay and two-realm isolation; add a noninteractive build VM proving
no prompt or silent escalation occurs.
For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.
Alternatives and tradeoffs
A global POSIX namespace or broad approval grant would exceed native capability ceilings. Mediate each client through its own authenticated route and keep compatibility orchestration out of rootd.
Validation checkpoint — 14 September 2026: Signed Posixd
52ef820d33399490c121aad3af1409139e4a8f44selects the proposed realm custody owner: Procd deposits an ancestor SEND-lineage revoker into its exact native generation before export and retains a nested guard for earlier realm retirement. Exported aliases descend from the nested guard; ancestor-only bypass and setup aliases must be removed before publication. Kernel supplies the existing terminal trigger; children, provider leases, receiver aliases and pending operations retain separate owners and acknowledgments. This is a documented design; Posixd has no executable crate or implemented realm handshake. Posixd CI 5 and 6 pass with complete warning-free logs. Signed Docsd9bb106b94deb7c2af620775dc98be0cc46ae704updates the process-services manual and records the separate owned invocation design. All 45 Docs tests and 55 Markdown files pass. The 2,341-page local manual has zero final warnings; 426,812 word boxes fit page bounds and the changed page was visually reviewed. Docs CI 849 and 850 pass; their manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. All six complete Posixd/Docs job logs total 760,808 bytes. Runtime producer adoption, realm byte I/O and both complete guest build generations remain open.Owned invocation wire and native acceptance — 15 September 2026: Signed Posixd
3118b9008a85977b48babc342ba0587ddc99dd57corrects stale upstream status and records producer adoption prerequisites. Kernel lifetime custody now supplies the surviving ancestor holder and actual Procd-terminal trigger, while the distinct nested producer revoker and complete realm cleanup are unimplemented. The shared immediate owned invocation wire/shim and Kernel adapter pass strict validation, component CI and an actual three-process CPL3 scenario covering all eight operations, including draining release and exact acknowledgment; the older lifetime VM also passes. Posixd still has no crate, executable or assigned startup/provisioning protocol. Current Procd intake can block on legacy transfer rendezvous and synchronous provider calls. Merely adding a realm table cannot establish bounded cleanup progress: the implementation must separately own and schedule native terminal intake, SEND-branch retirement and provider completion, retain actual moved install/guard custody, authenticate exact generation-bound readiness/configuration, dispose setup authority and only then seal. Native alias absence, process destruction and application completion remain distinct. Markdown, canonical headings/governance bytes, local links and whitespace pass for this documentation-only correction; Rust/image tests are not applicable to this repository change. Matching technical-manual realm prerequisites and the accepted syscall chapter remain current. Posixd CI 7/8 succeeds; both complete Markdown logs total 7,244 bytes with no warnings. This completed cohort is stopped. Two realms with two clients each performing mediated byte I/O, broader failure/reuse evidence, full audits and both complete EriX-in-EriX build generations remain open.Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required.
Process-bound native acceptance — 15 September 2026: Signed Kernel
60da5858d7198185efd103f0e91e5ac2e0b63e67implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procdf1105706cc19ed024a6cca79a29abc57c90c6661uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPCc453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABIfe8d558253ad01301b99554e20d287c4ea35bb1dand five aligned helper commits preserve original Git/type identity. Integration58c925c564b69bebce8df6f3e75a9312824e18c4passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docsb0fcf0f43af2af741d520a0b1373cc346e08863cupdates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.Staged mediator source checkpoint — 15 September 2026: Signed Loaderd
adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd64b563482c9ecab115283fe56c8562d948fbbabdand Procdcdb0fe4d1496073521626ce21f0fa2c95a81bd36implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC5fa5fdb2edbfe963efae1c11f99a3a58d0062509and capability ABIe5a3e864491479981b9ab37749109dafe52fa330plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.Native bootstrap destination correction — 15 September 2026
The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI
c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5corrects the constant; Kernelb98156427362a468ae78195a3582901e2474fea5adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.Corrected native staging checkpoint — 15 September 2026: Signed source
a174994ac6ebe5561f6bc1095cb3abcb3ec71d91is recorded in the current review. Document private mediator custody, staged handoff and the remaining typed bootstrap, seal and retirement contract. This repository has no runtime crate. Markdown, template-heading, governance-identity and whitespace checks pass. Rust/native checks do not apply to this documentation-only repository. Push CI 11 and review CI 12 pass with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.Coordinated terminal observation checkpoint — 17 September 2026: Signed revision
60fb8a3a7ad685d4378ca4299b9c7fbf9809c3d4is pushed. The realm ownership documentation adopts the checked native generation prerequisite. Canonical headings, governance identity, Markdown and whitespace pass. This repository still contains no Cargo crate or executable service; local Rust tests are not applicable. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and
staged-abort operations 56 and 57. A checked request carries the nonzero original
process/generation pair in the low/high 32-bit halves of arg0; flags and all other
arguments are zero. Retire selectors 8 and 35 without reinterpreting them or
adding a compatibility fallback. The existing held Process or Root route remains
required; descriptive identities do not grant authority.
Match the exact pair under the same TCB record lock that enters retained cleanup.
Preserve terminal-versus-Created eligibility, partial disposal and retry custody.
An absent or different generation acknowledges absence of only the requested
instance, with zero response values; it cannot mutate a replacement. Migrate
every native caller and carry creation/event generation through deferred retries.
Account for processes created before a service's own managed ledger without
reconstructing historical identity from the current record. Maintain separate
terminal observation, cleanup custody, provider completion and native absence.
Required evidence includes exact wire and reserved-field controls, actual-object
generation/reuse and failed-release controls, consumer cleanup tests, and bounded
CPL3 native coverage. Update all operation inventories, Rootd's measured audit
contracts, canonical documentation and manual/API references. Validate coherent
original commit dependencies, complete strict component matrices and repository
CI checks, then monitor original workflows. Ordinary mediator start, whole-image
admission and both complete builds inside EriX remain separate open gates.
Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision
2aefcaa7b2d847a6982d5d24fefac89a536e6bf8is pushed. The architecture and roadmap record the exact-generation cleanup prerequisite and native test scope. Markdown and document-template checks pass, as do original CI 15/16 with both complete logs (7,232 bytes), without warnings. This repository remains a design specification: Rust and Posixd runtime VM tests are not applicable to this documentation-only checkpoint. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open.Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing
private Launchd route. The native pending caller must match a retained running
Launchd generation. Its exact 32-byte request carries u32 request ID, opcode,
original process/generation, source and original destination install-grant slots,
then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly
GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native
matching-grant checks establish custody. Previously guarded, started, stale,
ordinary-role and malformed stages refuse before new effects.
Reserve exact rollback ownership first. Use the real returned grant and native
operation 53 to narrow the Created child's primary endpoint to RECV. Establish
an ancestor SEND branch under Kernel lifetime custody and a distinct nested
explicit revoker before any export. Retain the nested sender privately; dispose
the original master, unguarded sender and ancestor-only bypass aliases. The
returned install grant stays exclusively owned for later typed installation.
No new endpoint factory or expanded Process endpoint policy is implied.
The exact 32-byte capability-free reply echoes request/opcode/result/process/
generation, followed by a u32 custody state and two zero words. State 1 occurs
exactly with OK and confirms only guarded unstarted-stage custody; failure state
0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal
cleanup must account for every reused scratch column, actual guard and exact
child identity. Uncertain disposal prevents reuse and ordinary continuation.
Keep ordinary mediator starts denied. Counted final receivers/configuration,
owned fair intake/provider/retirement progress, private execution, authenticated
readiness, initial receiver disposal, seal/publication, real two-realm client I/O
and both complete builds inside EriX remain required. Host models or this guarded
stage acknowledgment cannot substitute for those acceptance gates.
Tracking and rollout
Validated mediator constructor adoption — 15 September 2026
Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place.
Producer implementation is signed at Procd
3d9fe97bb66ea82442728ef8a10b998d7159a9ba. Procd passes 55 focused materialization controls and 234/239 default/all tests, strict host/native Clippy, rustdoc, formatting and forty freestanding builds across ten binaries. Exact requests, omitted receipt/drop, materialization, refusal without fallback and unchanged ordinary behavior are covered. CI 272/273 passes with complete warning-free logs.The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs
8b30523f3d7e1c300f39e3418a8748dae10ec04f; all 45 tests, final warning-free rendering and CI 877/878 pass.Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete.
Construction without child root capabilities — 15 September 2026
Native prerequisite implemented at Kernel
6d2ca19c48d3663db4b3a1eba4e9b7588b351f6fwith shared IPC7c7712057cc5d16ab16a677a886caeac54814a16. Kernel operation 54 admits only actual Process endpoint holders and constructs a Created child with exactly one primary endpoint and no root capabilities. The native TCB retains address-space backing independently. The caller receives a unique install grant, an endpoint master and only an explicitly requested MAP-only VSpace receipt. The checked request distinguishes absence from a genuine slot-zero receipt. Former-root slots are usable; actual caller windows, native capacity, occupancy and child window scope remain enforced. Rollback disposes only successful new receipts and the partial child while preserving pre-existing bindings. Ordinary operation 32 remains unchanged. Initial inventory is not a seal or a permanent ban on later explicit installation. Both isolated native VMs pass; no runnable mediator follows from this prerequisite.Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.
Staged endpoint attenuation checkpoint — 15 September 2026
Native prerequisite implemented at Kernel
d690eda817e56b515a278bdbb5ea6c5aedeb431bwith shared IPC74c75a5db226413c066b6582210a44cb21d968d8. Kernel operation 53 narrows only the actual install grant's matching Created child's primary endpoint. The grant must cover the current rights as well as the requested result. Final identity/state checks and the allocation-free CSpace mutation share the child record lock. Exact zero and repeated reduction preserve object identity, other aliases and revocation associations; restored rights, stale or foreign targets, malformed fields and started children refuse. Both isolated native VMs pass; this does not establish a runnable mediator.Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete.
Older CI disposition — 15 September 2026: Previous review run 10 failed and its terminal log endpoint returned HTTP 500 on two spaced checks. CI issue 6 tracks the missing evidence and unknown cause. Current signed source passes both CI 11/12 with complete warning-free logs.
Dependencies: integration#1, lib-posixabi#1
Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use
feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.
Guarded-custody documentation reconciliation — 19 September 2026: signed Posixd PR 5,
9b031a8c2f996491a322046a4f2acd5dacdc55c2, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable.Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original Posixd CI 17 and 18 both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository.
Signed Docs PR 4,
7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original Docs CI 977 and 978 are running. These documentation corrections add no runtime behavior; the previously retained Integration78557a6c672ecf426dfe894a01cc4aeec73b5e3cappliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required.Original Docs CI 977/978 passes for signed 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result.
Minimum bootstrap design — 19 September 2026: signed Posixd proposal, in PR 5, specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate.
Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution.
The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original Posixd CI 19 and 20 pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added.
Native child-lifetime prerequisite — 19 September 2026: Kernel design #19 now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration
a62d1381f56a01afc692112d9b427205eaeb6a2e. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.[FEATURE] [P06] Implement isolated compatibility realms and exact grant lifecyclesto [FEATURE] Implement isolated compatibility realms and exact grant lifecycleserikinkinen referenced this issue from erix/docs2026-09-12 20:52:05 +02:00